GHSA-8Q3C-RJR9-XXRP VictoriaMetrics vmrestore: Path traversal via crafted backup part names escapes restore root

Summary The VictoriaMetrics vmrestore utility does not validate backup part path components before writing restored files to the local filesystem. An attacker who can provide or modify a backup source can craft object names containing .. path components that cause vmrestore to write files outside...

EUVD-2026-63474

VictoriaMetrics vmrestore: Path traversal via crafted backup part names escapes restore root...

VictoriaMetrics vmrestore: Path traversal via crafted backup part names escapes restore root

Summary The VictoriaMetrics vmrestore utility does not validate backup part path components before writing restored files to the local filesystem. An attacker who can provide or modify a backup source can craft object names containing .. path components that cause vmrestore to write files outside...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through the restore path handling in lib/backup/actions/restore.go, lib/backup/common/part.go, and lib/backup/fslocal/fslocal.go. An attacker can write or overwrite files outside the configured -storageDataPath by...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through the restore path handling in lib/backup/actions/restore.go, lib/backup/common/part.go, and lib/backup/fslocal/fslocal.go. An attacker can write or overwrite files outside the configured -storageDataPath by...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through the restore path handling in lib/backup/actions/restore.go, lib/backup/common/part.go, and lib/backup/fslocal/fslocal.go. An attacker can write or overwrite files outside the configured -storageDataPath by...

CVE-2026-61625

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below...

CVE-2026-61625 VictoriaMetrics vmrestore: path traversal via crafted backup part names escapes restore root

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below...

CVE-2026-61625

VictoriaMetrics vmrestore is vulnerable to a path traversal caused by insufficient validation of backup part path components in lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go. An attacker who can supply or modify a backup source (S3, GCS, Azure Blob Storage, or other) can embed ....

CVE-2026-61625 VictoriaMetrics vmrestore: path traversal via crafted backup part names escapes restore root

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below...

CVE-2026-61625 VictoriaMetrics vmrestore: path traversal via crafted backup part names escapes restore root

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below...

PT-2026-79061

Name of the Vulnerable Software and Affected Versions VictoriaMetrics versions prior to 1.122.25 VictoriaMetrics versions prior to 1.136.12 VictoriaMetrics versions prior to 1.146.0 Description The vmrestore tool fails to validate backup part path components before writing restored data below...

CVE-2026-61625: Improper Limitation of a Pathname to a Restricted Directory

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below...